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1.  INTRODUCTION 


Safety  of  aircraft  flight  is  of  great  concern  to  all  those  connected 
with  aviation.  The  Department  of  Transportation's  Federal  Aviation  Adminis- 
tration (FAA)  has  a major  responsibility  for  the  maintenance  and  Improvement 
of  flying  safety  through,  for  example,  certification  of  pilots  and  equip- 
ment, the  establishment  of  an  air  traffic  control  system,  and  the  dissemina- 
tion of  rules  and  regulations  to  ensure  orderly  flow  of  traffic.  This  report 
will  .be  concerned  with  aspects  of  the  latter  function:  specifically,  rules 
pertaining  to  the  safe  separation  of  aircraft  and,  more  particularly,  sep- 
aration of  aircraft  in  the  vertical  dimension. 

The  scope  of  the  present  study  includes  only  level  flight  — above 
Flight  Level  (FL)  290.  At  and  above  29,000  feet  internationally  and  18,000  feet^ 
in  the  Eastern  United  States,  "altitude"  is  measured  not  by  actual  elevation 
above  sea  level  but  rather  in  terms  of  pressure  altitude  based  on  a standard 
sea  level  pressure  of  29.92  inches  of  mercury  (1013.25  mb.)  and  a standard 
temperature  gradient.  Pressure  altitude  in  hundreds  of  feet  is  then  referred 
to  as  Flight  Level.  Thus  Flight  Level  290  is  approximately  29,000  feet  above 
sea  level,  depending  on  the  actual  barometric  pressure  at  sea  level  and  other 
factors.  We  initially  focus  on  altitudes  at  and  above  FL290  since  at  these 
altitudes  terrain  considerations  can  be  ignored;  Mount  Everest  rises  29,028 
feet  above  sea  level,  but  apart  from  the  Himalayas  no  mountains  are  this 
high.  Moreover,  current  regulations  require  1000-foot  separation  between 
aircraft  below  FL290  and  require  2000-foot  separation  above  FL290  . We 
consider  only  level  flight,  excluding  ascents  and  descents,  both  because  the 
separation  rules  in  question  address  this  portion  of  flight  and  because  level 
flight  permits  simpler  analytical  treatment  than  do  other  maneuvers. 

Separation  of  aircraft  laterally,  longitudinally  and  vertically  is  de- 
signed to  enhance  safety  by  providing  enough  airspace  surrounding  each 
aircraft  to  allow  for  errors  in  its  nominal  position.  The  separation  standards 
are  established  in  such  a manner  that  separation  in  any  one  of  the  three 
dimensions  itself  provides  a measure  of  safety.  This  is  required  because  in 
order  to  use  airspace  efficiently  it  may  frequently  be  necessary  to  assign 
aircraft  to  parallel  tracks  (where  only  lateral  separation  applies),  to  the 
same  track  (where  only  longitudinal  separation  applies)  or  to  adjacent  flight 
levels  on  the  same  route  (where  only  vertical  separation  applies) . The 
present  report  will  be  concerned  primarily  with  this  latter  case,  but  it  must 
always  be  kept  in  mind  that  any  measure  of  safety  must  take  into  account  all 
three  dimensions  and  the  relative  frequency  with  which  separation  in  each 
will  provide  the  sole  safety  margin. 

"Safety"  is  a concept  which  is  very  difficult  to  define  with  sufficient 
precision  to  allow  its  quantification.  Nevertheless  it  is  essential  to  have 
such  a measure  in  order  to  evaluate  the  effects  of  proposed  system  changes 
on  safety  as  a basis  for  Justifying  (or  rejecting)  those  changes.  As  parts 

^Units  customarily  used  in  aviation  — feet,  nautical  miles,  knots  and  Mach 
number  — will  be  used  in  this  report  for  ease  of  assimilation  by  an  aviation 
reader. 
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of  the  system  become  saturated  and  changes  in  rules  are  proposed  which  would 
alleviate  congestion,  the  probable  effects  on  safety  must  be  evaluated  using 
some  numerical  measure  of  the  respective  risks  under  the  original  and 
modified  rules.  On  the  one  hand,  the  flying  public  wants  maximal  safety 
guaranteed  by  the  procedures  governing  air  traffic  control.  On  the  other  hand, 
airline  operators  are  not  only  concerned  with  safety,  but  also  want  procedures 
to  allow  efficient  use  of  their  aircraft.  Since  aircraft  are  designed 
to  operate  most  efficiently  within  a rather  narrow  altitude  range,  this  results 
in  a large  number  of  aircraft  desiring  to  fly  at  the  same  altitude.  Both 
passehgers  and  airline  operators  want  reduced  delays.  Some  measure  which 
can  be  used  to  quantify  the  risks  in  flying,  as  related  to  the  characteristics 
of  aircraft  equipment  and  flying  procedures,  is  needed  to  aid  in  rule-setting. 
An  "ideal"  measure  may  be  impossible  in  principle  and  is  certainly  beyond 
present  abilities  to  quantify,  but  some  surrogate  measure,  recognized  as  not 
wholly  adequate  but  designed  to  reflect  those  properties  of  safety  which 
can  be  quantified,  may  well  be  attainable. 


It  is  therefore  desirable  to  quantify  the  risk  of  collision  between  two 
aircraft  resulting  from  a loss  in  vertical  separation  between  those  aircraft, 
and  to  do  so  in  a manner  that  permits  evaluating  the  impact  upon  safety  of 
changes  in  the  rules  or  equipment  of  the  system.  Above  FL290  accidents 
have  three  primary  causes:  collision  between  two  aircraft,  equipment  failure, 
and  weather  effects.  The  first  of  these  is  of  most  interest  in  evaluating 
separation  standards,  but  the  effects  of  the  latter  two  must  also  be  considered. 


In  designing  a safety  measure  for  flight  at  or  above  FL290,  it  is  necessary 
to  resolve  several  questions: 


Do  we  simply  count  the  aircraft  involved  or  should  the  number  of 
passengers  in  the  aircraft  be  reflected  in  the  measure? 


Does  one  consider  collisions  only,  or  should  near-misses  also 
affect  the  measure? 


Should  the  measure  concern  number  of  incidents  per  flight,  per  flying 
period  (hour,  day,  week,  or  year?),  per  distance  flown,  per  passenger 
flying  period  or  per  passenger  distance  flown? 


The  safety  measure  chosen  deals  with  aircraft  rather  than  passengers, 
primarily  because  aircraft  are  elements  over  which  the  present  air  traffic 
control  system  (or  its  likely  successors)  has  some  control.  System  improve- 
ments will  affect  aircraft  directly  or  will  affect  the  monitoring  and  navi- 
gation equipment  which  in  turn  affects  aircraft.  At  the  altitudes  of 
interest  here  (FL290  and  above),  most  of  the  traffic  is  commercial  jet 
aircraft  and  any  collision  is  likely  to  result  in  death  for  all  persons  on 
board,  so  that  aircraft  collisions  are  the  most  relevant  factor.  Near-misses 
certainly  contribute  to  a perceived  degradation  of  safety,  but  it  is  difficult 
to  obtain  reliable  information  about  them,  since  only  some  are  actually 
reported  and  what  was  viewed  as  a near-miss  by  one  pilot  may  not  have  appeared 
a hazardous  situation  to  the  other. 


Since  flights  differ  greatly  in  length,  the  length  of  exposure  to 
collision  varies  from  flight  to  flight.  A better  measure  of  the  risk  of 
collision  is  the  number  of  collisions  per  time  period  or  per  distance  flown. 
Most  of  the  aircraft  flying  at  an  altitude  of  29,000  feet  or  more  are  in 
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en  route  airspace  and  fly  at  a speed  of  about  0.8  Mach  or  greater,  so  that 
time  and  distance  are  directly  related;  but  since  airline  crew  staffing  and 
aircraft  maintenance  procedures  rely  on  cumulative  flying  time,  time-related 
figures  are  tpore  readily  available  than  those  on  the  number  of  aircraft 
miles  flown.  Thus  the  unit  chosen  in  this  report  (as  well  as  elsewhere) 
for  measuring  the  safety  of  aircraft  flight  is  the  number  of  collisions  per 
flying  hour.  This  measure  has  been  called  [36]  the  collision  risk  to  which 
an  aircraft  is  exposed. 

Loss  of  vertical  separation  results  from  a discrepancy  between  the  as- 
signed flight  level  and  the  actual  altitude  flown  (or  possibly  from  an  im- 
properly assigned  flight  level,  but  this  contingency  will  not  be  included 
in  the  error  analysis  below) . The  discrepancy  between  assigned  and  actual 
altitude  will  be  called  "total  vertical  position  error".  Figure  1 contains 
a diagram  of  the  height-keeping  system:  the  subsystems  subject  to  error 

are  designated  by  hexagonal  boxes  and  the  relevant  outputs  of  these  sub- 
systems are  displayed  in  rectangular  boxes.  As  indicated  by  the  figure, 
the  three  main  subsystems  contributing  to  vertical  position  error  are: 

1)  the  static  pressure  system,  which  senses  the  ambient  air  pressure, 

2)  the  altimeter  instrument  system,  which  translates  (mechanically  and 
possibly  electronically)  the  pressure  sensed  by  the  pitot-static 
system  into  a flight  level  indicated  on  a guage  in  the  cockpit  (for 
a more  complete  description  of  the  operation  of  an  altimeter,  the 
reader  is  referred  to  [13]  and  [16]),  and 

I 

3)  the  pilot  response,  which  reflects  the  ability  of  the  pilot  to 
maintain  a desired  gauge  reading. 

We  also  consider  a fourth  category,  that  of  "miscellaneous"  error  sources. 

Included  in  this  category  are  errors  in  the  Mode  C transponder  system  by 
which  the  altimeter  reading  is  automatically  transmitted  to  the  air  traffic 
controller;  these  become  especially  important  if  controller  decisions  rely 
on  the  erroneous  data.  It  is  important,  in  this  regard,  to  realize  that 
total  failure  of  the  altimetry  system  can  be  readily  identified  and  appro- 
priate safety  precautions  applied  by  cooperation  between  pilot  and  the  con- 
troller. Problems  arise  with  less  readily  noticed  system  failure. 

Errors  in  the  three  major  subsytems  listed  above  would  appear  to  have 
relatively  little  effect  upon  one  another,  since  such  errors  result  from 
physically  separate  processes.  With  reference  to  Figure  2,  the  static 
pressure  system  error  is  represented  by  the  difference  between  the  actual 
pressure  altitude  flown  and  the  pressure  measured  by  that  system.  The 


2 

The  use  of  accidents  per  miles  flown  may  be  misleading,  as  noted  by  G. 
Raisbeck,  B.  0.  Koopman,  S.  F.  Lister  and  A.  S.  Kapadia,  A Study  of  Air 
Traffic  Control  System  Capacity,  Report  Number  FAA-RD-70-70,  Authur  D. 
Little,  Inc.  Cambridge,  Mass.  02140,  Oct.  1970,  pp. 57-58. 
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FIGURE  2 


Subsystem  Errors  Involved  in  Vertical  Position  Error 
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TOTAL  VERTICAL 
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altimeter  Instrument  error  corresponds  to  the  difference  between  the  measured 
pressure  altitude  and  the  altitude  displayed  In  the  cockpit,  while  the  pilot 
response  error  corresponds  to  the  difference  between  the  displayed  altitude 
and  the  altitude  assigned  to  the  aircraft.  Total  vertical  error  is  the 
algebraic  sum  of  the  errors  in  the  three  subsystems,  and  these  latter  errors 
are  expected  to  be  relatively  uncorrelated  with  one  another.  The  as- 
sumptions involved  in  this  simple  model  of  total  vertical  error  are  discussed 
in  Section  3.5. 


The  body  of  this  report  is  divided  into  three  sections.  The  first  of 
the  following  sections  discusses  factors  contributing  to  the  errors  in  each 
of  the  above  categories,  and  provides  estimates  of  the  magnitudes  and 
statistical  distributions  of  the  error  factors.  The  second  section  focuses 
on  models  of  total  vertical  error  and  on  the  calculation  of  collision  risk. 
Two  notable  approaches  taken  by  previous  investigators  are  given,  the  root 
sum  of  squares  approach  and  the  Reich  collision  risk  model,  and  various 
assumptions  underlying  those  approaches  are  examined.  The  final  section 
discusses  the  data  needed  to  verify  and  analyze  an  appropriate  model  to- 
gether with  its  assumptions.  Emphasis  is  placed  on  the  relationship  be- 
tween the  characteristics  of  the  data  set  and  the  model  analysis,  rather 
than  on  questions  of  feasibility  or  practicality.  An  appendix  contains 
mathematical  analyses  comparing  tail  lengths  (i.e.  comparing  frequencies 
of  rare  events)  for  some  of  the  combinations  of  distributions  discussed 
in  Section  3. 
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In  this  section  we  will  examine  various  factors  and  errors  contributing 
to  the  three  major  error  categories:  static  pressure  system  error,  altimeter 

instrument  error,  and  errors  in  pilot  actions.  A miscellaneous  category  will 
also  be  included  to  cover  factors  not  falling  naturally  under  one  of  the  other 
three  headings. 

2 . 1 Static  Pres sure  System  Errors 

An  alt i- 'ter  is  essentially  a device  for  sensing  the  ambient  air  pressure 
outside  the  aircraft  and  translating  the  pressure  measurement  into  an  equiva- 
lent altitude,  using  physical  relations  such  as  that  equating  pressure  with 
the  weight  of  the  column  of  air  above.  The  pitot-static  system  embodies  the 
air  pressure  sensing  devices;  it  consists  of  various  orifices  and  tubes  which 
allow  air  (at  pressure)  outside  the  aircrafts  skin  to  be  transmitted  to  the 
altimeter  diaphragm  within  the  aircraft.  Clearly,  since  the  aircraft  itself 
disturbs  the  air  surrounding  it,  the  location  of  the  static  pressure  source 
on  the  aircraft  skin  is  critical  [13].  In  addition,  the  attitude  or  angle 
of  attack  of  the  aircraft  affects  the  direction  of  the  airstream  flowing  past 
or  into  the  static  pressure  source,  influencing  the  measured  air  pressure. 

The  speed  of  the  aircraft  (measured  as  Mach  number)  also  affects  the  airstream 
passing  the  static  pressure  sensor,  as  does  local  deformation  of  the  aircraft 
skin  near  the  sensor.  Factors  affecting  static  pressure  system  error  — the 
discrepancy  between  the  ambient  atmospheric  pressure  and  the  pressure  measured 
by  the  pitot-static  system  — are  listed  and  described  below. 

A.  Factors  varying  during  flight 

1.  Altitude : The  relationship  between  pressure  and  altitude  is  quite 

nonlinear,  so  that  an  exact  correspondence  between  pressure  and 
altitude  may  not  be  possible  using  existing  equipment.  Therefore, 
errors  in  the  altitude  measurement  may  depend  on  the  altitude  itself. 

2.  Mach  number:  Aircraft  speed  affects  the  speed  of  the  airstream  moving 

past  the  static  pressure  source  and  thus  the  pressure  measurement. 

3.  Angle  of  attack:  The  attitude  of  the  aircraft  can  affect  the  move- 
ment of  the  airstream  past  the  static  pressure  opening  and  thus  in- 
fluence the  measured  air  pressure. 

B.  Factors  varying  among  aircraft 

1.  Location  of  sensor:  The  airstream  flow  in  the  neighborhood  of  the 

static  pressure  source  differs  depending  on  where  the  source  is  located 
on  the  aircraft's  hull.  Different  locations  react  differently  to 
flying  maneuvers  and  thus  entail  different  pressure  measurement 
characteristics. 
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2.  Skin  deformation:  Any  dent  in  the  aircraft  skin  near  the  static 

pressure  source  affects  the  local  airstream  characteristics.  In 
addition,  normal  skin  deformation  in  the  region  near  the  sensor 
location  changes  during  flight  and  consequently  affects  the  pressure 
measurement. 

3.  Leaks  in  the  pitot-static  system:  If  there  are  any  leaks  in  the 

pitot-static  system,  an  incorrect  pressure  will  be  transmitted  to 
the  altimeter  diaphragm. 

t 

4.  Aircraft  type:  Different  aircraft  have  different  shapes  and  weights, 

thus  disturbing  the  atmosphere  in  different  ways.  Different  aircraft 
types  also  may  be  equipped  with  different  altimeters  and  have  different 
sensor  locations,  as  well  as  different  pitot-static  configurations 
(separate  pilot  and  co-pilot  sensors  versus  a common  one,  for  example). 
All  of  these  variations  may  lead  to  differences  in  measurement  capa- 
bility. 

5.  Calibration  test  procedures:  Initial  static  pressure  system  per- 

formance is  verified  by  trailing  cone  tests  during  aircraft  certi- 
fication and  is  subsequently  tested  for  leaks  only  at  two  year 
intervals.  Actual  tolerances  and  test  intervals  (less  than  the 
two  year  minimum)  may  vary  from  operator  to  operator. 

Time-varying  factors 

1.  Calibration  test  interval:  Since  the  calibration  procedures  are 

set  up  separately  by  each  airline  or  owner,  the  interval  between 
tests  may  vary  up  to  a maximum  interval  set  by  the  certifying 
authority.  If  the  performance  of  the  instrument  typically  de- 
grades over  the  interval  between  calibrations,  then  the  time  since 
the  last  test  will  affect  the  accuracy  of  the  measurements. 

2.  Age  of  the  pitot-static  system:  The  pitot-static  system  may  de- 

teriorate with  time,  thus  affecting  the  accuracy  of  pressure 
measurement . 

D.  Meteorological  effects 

1.  Density  and  temperature:  The  density  and  temperature  of  the  at- 

mosphere may  differ  from  those  assumed  for  the  standard  atmosphere, 
so  that  the  actual  relationship  between  pressure  and  altitude  may 
differ  from  that  assumed.  This  may  cause  the  actual  distance  be- 
tween flight  levels  to  be  less  than  (or  greater  than)  the  separ- 
ation standard. 

2.  Turbulence,  wild  and  other  weather  conditions:  The  measurement 

of  air  pressure  in  turbulent  air  is  difficult  because  of  the  un- 
stable conditions.  Strong  winds  may  also  affect  the  pressure 
readings. 
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2.2  Altimeter  Instrument  Errors 

The  altimeter  instrument  measures  the  pressure  transmitted  by  the 
pitot-static  system  and  translates  that  pressure  into  an  equivalent  altitude 
displayed  to  the  pilot.  The  altimeter  instrument  errors  listed  below  con- 
tribute to  discrepancy  between  the  pressure  measured  by  the  pitot-static  system 
and  the  equivalent  flight  level  indicated  on  the  pilot's  altimeter  gauge. 

A.  Mechanical 

1.  Diaphragm  error:  Equal  changes  in  atmospheric  pressure  at  different 

heights  can  produce  different  diaphragm  deflections,  as  a result  of 
the  physical  properties  and  construction  of  the  aneroid-linkage 
system. 

2.  Hysteresis  error:  Hysteresis  is  the  phenomenon  in  which  the  reaction 

of  a system  to  changes  is  dependent  upon  its  past  reactions  to  change. 
In  the  altimeter,  the  diaphragm  deflection  depends  upon  whether  the 
current  altitude  was  reached  from  above  or  from  below. 

3.  Drift  error:  There  is  a tendency  to  deviate  from  a constant  altitude 

reading  over  long  (1  to  4 hours)  exposure  to  that  altitude. 

4.  Friction  error:  Friction  occurs  in  transmission  of  diaphragm  move- 

ment to  the  pointers  and  in  the  temperature  compensating  pins.  This 
can  cause  small  deviations  in  altitude  to  go  unrecorded,  contributing 
to  a loss  in  precision  of  the  instrument. 

5.  Backlash  error:  Motion  is  lost  in  the  gear  transmission  between  the 

pressure  and  altitude  scales. 

6.  Instability  error:  Changes  occur  in  the  altimeter  indication  fol- 

lowing consecutive  ascents  and  descents. 

7.  Temperature  error:  Temperature  in  the  instrument  panel  can  affect  the 

altimeter  indication. 

8.  Scale  error:  This  error  is  due  to  the  inability  to  match  exactly 

the  movement  of  the  altitude  pointer  with  the  deflection  of  the 
aneroid-linkage  mechanism. 

B.  Readability 

1.  Pressure  setting  error:  The  pressure  scale  can  only  be  set  to  an 
accuracy  determined  by  its  graduation  interval,  so  that  the  altitude 
readings  are  accurate  only  to  an  equivalent  precision. 

2.  Altitude  reading  error:  The  height  scale  of  the  altimeter  can  only 

be  read  to  a precision  determined  by  Its  graduation  interval. 
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C.  Errors  Arising  From  Nonstandard  Setting^ (i.e.  Using  Other  than  the 
Standard  Atmosphere  Reference  Pressure)"' 

1.  Coordination  error:  A complete  coordination  between  the  gradua- 

tions of  pressure  and  height  scales  becomes  impossible. 

2.  Balance  error:  The  state  of  balance  of  all  moving  parts  of  the  al- 

timeter changes  when  rotated  from  the  calibration  position. 

3.  Zero-setting  error:  The  calibration  correction  at  certain  heights 

should  be  different  if  a nonstandard  reference  pressure  datum  is  used. 

i 

4.  Incorrect  local  barometric  pressure:  The  pilot  receives  ground - 

level  barometric  pressure  information  from  ground  stations  and  resets 
his  pressure  gauge  accordingly.  If  an  incorrect  pressure  is  trans- 
mitted or  the  value  garbled,  the  pilot  may  be  using  an  erroneous 
local  barometric  pressure  setting. 

D.  Calibration  procedures 

1.  Installation  error:  The  altimeter  may  register  incorrectly  if  the 

instrument  is  installed  in  the  aircraft  improperly,  or  if  irregularly 
standardized  reference  equipment  or  inappropriate  procedures  are 
used  during  calibration. 

2.  Calibration  frequency:  The  frequency  of  calibration  tests  is  to  some 

extent  under  the  control  of  the  owner  and  will  thus  vary  among  owners. 

3.  Procedural  error:  When  an  altimeter  without  automatic  compensation 

for  calibration  discrepancies  is  used,  the  pilot  must  apply  calibra- 
tion corrections  (primarily  to  adjust  for  scale  error)  listed  on  a 
cockpit  card.  Clearly  this  is  a source  for  error,  particularly  if 
the  pilot  has  a Mode  C transponder,  since  the  transponder  will  trans- 
mit the  uncorrected  flight  level  to  the  controller  who  will  then 
perceive  the  aircraft  at  a slightly  "improper"  altitude. 

4.  Calibration  adjustment  error:  A residual  error  may  remain  after  the 

calibration  corrections  have  been  applied  to  the  altimeter  system, 
since  the  instrumentation  may  be  unable  to  account  for  all  non- 
linearities. 


E.  Other 

1.  Altimeter  type:  There  are  three  categories  of  altimeters: 

Type  I - a mechanical  instrument  ("pressure  sensitive"  altimeter) 

Type  II  - an  improved  mechanical  instrument  ("precision  pressure" 
altimeter) 

Type  III  - an  altimeter  with  servo-correction  facilities 


These  errors  do  not  apply  to  flight  above  FL290,  since  the  standard  atmospheric 
setting  of  29.92  inches  of  mercury  is  used  in  this  altitude  range. 
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Types  II  and  III  are  the  ones  of  greatest  interest,  because  they 
are  probably  the  only  ones  found  in  aircraft  flying  above  FL290. 

Differences  in  mechanical  and  calibration  errors  exist  among  the 
three  types. 

2.  Aging:  Since  mechanical  components  are  subject  to  wear  and  deterio- 

ration, altimeters  can  develop  a systematic  deterioration  in  accuracy 
between  overhauls. 

2.3  Pilot  Response 

The  pilot  reads  the  altitude  displayed  on  the  altimeter  gauge  in  the 
cockpit,  and  uses  that  information  to  guide  the  aircraft  relative  to  the  as- 
signed flight  level.  This  task  may  be  performed  well  or  poorly.  Different 
pilots  may  perceive  the  necessity  of  adhering  to  assigned  altitude  as  more 
or  less  important,  and  may  allow  different  margins  for  error. 

Human  errors  in  the  assignment  of  altitude,  the  setting  of  the  value  of 
the  standard  atmosphere  on  the  altimeter  pressure  gauge,  or  the  reading  of  the 
altimeter  gauge  may  also  contribute  to  altitude  error.  Sloppy  and  inattentive 
flying  may  to  some  extent  be  corrected  through  the  use  of  altitude-hold  equip- 
ment whereby  the  autopilot  attempts  to  maintain  altitude,  but  even  here  there 
may  be  errors  in  initiating  the  correct  altitude.  Also,  the  altitude-hold 
feature  is  usually  disengaged  under  turbulent  weather  conditions.  Human  errors 
leading  to  discrepancy  between  the  altitude  displayed  on  the  pilot's  al- 
timeter gauge  and  the  altitude  to  which  he  was  assigned  are  described  below. 

A.  Flight  technical  error.  This  term  usually  applies  to  a collection  of  human 
errors  which  manifest  themselves  in  altitude  variations  during  supposedly 
level  flight.  Several  causes  are  given  below. 

1.  Sloppy  flying:  Pilots  have  many  duties  to  perform  and  thus  attention 

cannot  be  focused  solely  on  altitude  maintenance.  In  addition,  pilots 
perceive  some  variation  from  the  assigned  altitude  as  acceptable 
without  degrading  safety,  because  of  inherent  errors  in  the  altimeter 
system. 

2.  "Blunders":  Several  outright  errors  in  procedure  may  contribute  to 

altitude  errors.  They  include 

- failure  to  apply  the  calibration  corrections  when  required, 

- misreading  the  altimeter  gauge, 

- missetting  the  standard  atmosphere  on  the  pilot's  pressure  gauge, 

3.  Altimeter  discrepancy:  Differences  in  the  readings  of  the  pilot's 

and  co-pilot's  altimeter  displays  contribute  to  the  pilot's  perception 
of  allowable  altitude  variation  and  thus  may  be  a source  of  error. 


B.  Altitude-hold  equipment 


1.  Malfunction  of  altitude-hold  equipment:  As  with  any  device,  the 

altitude-hold  mechanism  may  malfunction,  causing  an  altitude  error 
which  may  or  may  not  be  caught  and  corrected  by  the  pilot. 

2.  Turbulence:  Turbulence  involves  sharp  pressure  changes.  During  such 

situations  the  altitude-hold  mechanism,  which  seeks  to  maintain  a 
given  altitude  (that  is,  to  follow  an  equal-pressure  contour),  will 

< tend  to  move  the  aircraft  rapidly  up  or  down  — clearly  an  undesirable 
practice.  Therefore  altitude-hold  is  usually  disengaged  during 
turbulent  weather  conditions. 

2.4  Additional  Factors 


Several  additional  factors  not  appearing  in  the  above  lists  also  contribute 
to  errors  in  the  vertical  separation  of  aircraft. 

A.  Size  of  aircraft.  Since  aircraft  occupy  space,  two  aircraft  whose  centers 
are  2000  feet  apart  are  actually  separated  by  less  than  2000  feet,  when 
the  distance  between  the  top  of  the  lower  aircraft  and  the  bottom  of  the 
upper  one  is  measured.  Thus  the  separation  between  aircraft  is  reduced  by 
the  height  of  an  aircraft  itself. 

B.  Different  reference  pressures.  In  lower  altitudes  and  at  the  interface  of 
FL290,  aircraft  at  adjacent  altitude  levels  or  in  the  same  area  may  be  using 
different  reference  pressure  data.  The  use  of  different  reference  pressures 
leads  to  differences  in  altitude  measurement  which  may  reduce  the  separ- 
ation between  the  aircraft. 

C.  Mode  C altitude.  A discrepancy  between  the  flight  level  indicated  on  the 
altimeter  gauge  in  the  aircraft  and  that  read  by  the  controller  on  the 
ground  may  result  from  defects  in  any  of  several  procedures,  including 

- encoding  of  the  Mode  C altitude  in  the  aircraft, 

- transmission  of  the  Mode  C response  (garbling), 

decoding  of  the  Mode  C response  on  the  ground. 

In  addition,  as  noted  above,  since  some  altimeters  require  calibration 
corrections  to  be  applied  by  the  pilot  and  the  display  does  not  reflect  these 
corrections,  the  Mode  C altitude  indicated  to  the  controller  may  show  the 
pilot  to  be  at  an  improper  flight  level  when  in  fact  the  aircraft  is  actually 
flying  the  assigned  level.  It  has  been  suggested  that  some  pilots  fly  with- 
out applying  the  corrections  in  order  to  maintain  the  appropriate  Mode  C read- 
out rather  than  the  correct  altitude.  Controllers  are  required  to  verify  on 
initial  contact  that  the  Mode  C reported  altitude  is  within  + 300  feet  of  the 
cockpit  altimeter  altitude.  If  that  correspondence  is  not  established  the 
pilot  is  requested  to  turn  off  the  Mode  C report.  After  verification  is  made, 
if  the  controller  observes  a discrepancy  of  + 300  feet  from  assigned  altitude 
he  is  required  to  notify  the  pilot.  Smaller  errors  need  not  be  reported.  Thus 
large  errors,  such  as  those  that  might  result  from  total  failure  of  the  altimetry 
system,  can  be  readily  identified  and  appropriate  safety  precaution  applied  by 
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cooperation  between  the  pilot  and  controller.  Less  than  complete  failure 
may  be  more  difficult  to  recognize. 


2 . 5 Estimates  of  Error  Sizes 

The  errors  described  above  have  been  discussed  in  several  publications 
[23,  25,  36,  41],  and  estimates  have  also  been  made  for  the  error  magnitudes 
and  their  statistical  distributions. 

Four  probability  distributions,  representative  examples  of  which  appear  in 
Figure  3,  have  been  used  to  describe  the  errors.  They  are  the  normal  (Gaussian), 
the  rectangular  (uniform) , the  limit  (2-point  discrete  uniform) , and  the  constant 
(degenerate  point)  distributions.  Any  component  error  following  a constant 
distribution  is  simply  a variable  that  takes  a single  fixed  value.  Such 
errors  (e.g.  aircraft  size)  can  be  considered  to  reduce  directly  the  effective 
nominal  spacing  between  aircraft;  once  the  appropriate  adjustment  has  been  made, 
these  errors  can  be  ignored. 

The  other  distributions  are  all  generally  assumed  to  have  a mean  of  0,  cor- 
responding to  the  notion  that  positive  and  negative  error  deviations  in  some 
sense  balance  one  another.  With  one  parameter  (namely,  the  mean)  fixed  in 
value,  only  one  other  parameter  must  be  known  before  the  distributions  of 
Figure  3 are  completely  specified.  The  standard  deviation  of  an  error  distri- 
bution having  finite  limits  (rectangular,  limit  or  constant)  is  easily  ex- 
pressed in  terms  of  the  maximum  possible  deviation  or  "tolerance"  , as  shown 
in  Figure  3.  By  making  an  estimate  of  this  maximum  deviation,  a procedure 
followed  in  [25],  an  estimate  can  thus  be  found  for  the  standard  deviation  of 
any  of  these  three  distribution  types.  In  the  case  of  a normal  distribution, 
however,  there  are  no  finite  limits  to  the  values  possible.  Accordingly,  it 
is  usually  assumed  that  + three  standard  deviations  adequately  delimits  the 
maximum  deviation,  since  for  a normal  distribution  99.7%  of  the  observations 
fall  within  three  standard  deviations  of  the  mean. 

Tables  1 through  4 below  contain  observed  values,  or  estimates,  taken 
from  these  publications  for  many  of  the  error  components.  The  tables  provide, 
for  each  component  or  combination  of  components,  the  source  reference  of  the 
data,  the  distribution  assumed  for  that  component,  the  standard  deviation  of 
the  distribution  and  a maximum  deviation.  Some  error  components  described  above 
do  not  appear  below  because  we  found  no  reference  to  quantitative  estimates 
for  them.  The  values  in  these  tables  are  included  mainly  as  an  indication  of 
the  relative  magnitude  of  errors,  and  no  endorsement  of  validity  or  usefulness 
is  implied. 

Values  in  parentheses  in  Tables  1 to  4 refer  to  a Type  III  altimeter, 
while  the  others  refer  to  a Type  II  altimeter.  The  numbers  under  "Source 
of  Data"  refer  to  the  references  in  Section  6 of  this  document.  These 
sources  range  from  one  as  early  as  1956  to  several  only  a few  months  old,  and 
many  of  the  larger  error  values  are  found  in  the  older  sources.  Some  of  the 
documents  use  slightly  different  data  categorizations  from  those  used  here  and 

_ 

The  term  "maximum  tolerance",  which  has  been  used  [25]  in  discussing  the 
numerical  magnitude  of  error  components,  is  not  intended  to  convey  the 
meaning  of  "permissible"  or  "allowable".  Rather,  this  usage  denotes  the  max- 
imum possible  magnitude  of  an  error  which  can  be  expected  to  be  observed. 
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FIGURE  3 


Possible  Distributions  for  Component  Errors 
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TABLE  1 

Ranges  of  Values  (in  Feet)  of  Static  Pressure  System  Errors 

at  FL  300 


Component 


Maximum 

Deviation 


Standard 

Deviation 


Assumed 

Distribution 


Source 
of  Data 


TABLE  2 


Ranges  of  Values 

(in  Feet)  of 

Altimeter 

Instrument  Errors 

at  FL 

300 

' Component 

Maximum 

Deviation 

Standard 

Deviation 

Assumed 

Distribution 

Source 
of  Data 

I. 

Mechanical  . 

DIAPHRAGM  (A.l)| 
HYSTERESIS (A. 2)  L 
DRIFT (A. 3)  J 

180-510 

(70) 

60 

(23) 

CONSTANT  [25] 
GAUSSIAN  [23] 

23,25 

FRICTION 
(A. 4) 

20-75 

(20) 

7-25 

(7) 

GAUSSIAN 

23,25 

BACKLASH 
(A.  5) 

10 

(10) 

10 

(10) 

LIMIT 

23,25 

INSTABILITY 
(A.  6) 

35-75 

(35) 

12-25 

(12) 

GAUSSIAN 

23,25 

TEMPERATURE 
(A. 7) 

10-35 

(35) 

3-12 

(12) 

GAUSSIAN 

23,25 

II. 

Readability 

PRESSURE 

(B.l) 

15 

(15) 

9 

(9) 

RECTANGULAR 

23,25 

ALTITUDE 
(B.  2) 

20 

(20) 

12 

(12) 

RECTANGULAR 

23,25 

TOTAL:  I + II 

64 

41 

III. 

Nonstandard 

Setting 

COORDINATION  (C.l) 

25 

8 

GAUSSIAN 

25 

BALANCE  (C. 2) 

20 

7 

GAUSSIAN 

25 

ZERO-SETTING (C.  3) 

30 

- 

CONSTANT 

25 

IV. 

Calibration 

ADJUSTMENT 

(D.4) 

-180  to  +80 
(120) 

8 
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TABLE  3 


3.  MODELING  APPROACHES 
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Several  different  methods  for  evaluating  vertical  separation  standards 
have  been  used  in  the  past.  The  two  most  notable  approaches  taken  in  previous 
studies  to  the  evaluation  of  safe  vertical  separation  standards  for  use  above 
FL290  are  described  below.  The  first  is  a procedure  in  which  information 
about  component  errors  is  combined  to  produce  a probability  distribution 
for  total  errors.  Assumptions  about  the  shape  of  that  distribution  and  an 
acceptable  frequency  of  rare  events  are  then  used  in  evaluating  a separation 
standard.  The  second  approach  is  a method  in  which  the  collision  risk  is 
related  to  the  frequencies  of  planes  being  less  than  an  aircraft  dimension 
apart  (in  any  of  the  three  directions)  and  to  the  probability  of  simultaneously 
overlapping  in  the  other  two  directions.  These  frequencies  and  probabilities 
are,  in  turn,  based  on  the  distributions  of  total  error  in  each  direction. 

A collision  risk  equation  is  then  used  to  determine  a separation  standard  which 
meets  an  acceptable  level  of  risk  determined  by  historically  calculated 
collision  risk  factors.  This  section  will  also  contain  a discussion  of 
other  possible  approaches  and  the  assumptions  upon  which  the  models  are  based. 

3 . 1 The  Root  Sum  of  Squares  (RSS)  Approach 

This  method  [42]  arrives  at  a total  vertical  error  distribution  by 
combining  the  distributions  of  certain  component  errors  believed  to  make  up 
the  total  error.  In  particular,  each  component  is  assumed  to  follow  some 
distribution,  usually  taken  to  be  symmetric  and  with  mean  0.  Generally,  in 
the  past,  the  distributions  of  individual  component  errors  have  been  chosen 
from  among  the  four  given  in  Figure  3 of  Section  2.5.  However,  the  RSS  pro- 
cedure will  work  equally  well  if  other  distributions  are  used. 


The  problem  now  is  to  describe  the  distribution  of  total  error,  given 
the  distributions  for  the  individual  component  errors.  Assume  that  the 
individual  errors  can  be  considered  as  simultaneous  contributions  that  add 
to  one  another  independently  in  producing  the  total  error.  Then  the  combined 
error  distribution  will  have  a standard  deviation  equal  to  the  square  root 
of  the  sum  of  the  squared  component  standard  deviations.  Accordingly,  this 
method  is  called  the  root  sum  of  squares  (RSS)  method.  More  precisely,  if 

and  standard 


X1 , X_,...,X  are  independent  random  variables  with  mean  0 
deviations  a1?,  a_,...,a  then  the  variable  X = 
mean  0 and  standard  dev?ation 
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This  method  for  finding  the  standard  deviation  of  the  total  error  distribution 
will  be  valid  as  long  as  the  following  assumptions  are  met: 


(1)  The  individual  errors  are  independent. 

(2)  The  individual  errors  combine  simultaneously  and  additively  to 
produce  the  total  error. 

(3)  All  of  the  individual  errors  that  comprise  the  total  error  have 
been  included. 

(4)  The  standard  deviation  of  each  individual  error  is  known. 
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Note  that  no  assumptions  have  to  be  made  concerning  the  particular  shapes  of 
the  distributions  for  the  individual  errors. 

At  this  point  certain  information  about  the  total  error  distribution  has 
been  obtained:  namely  its  mean  (=0)  and  its  standard  deviation  (a). 

Knowledge  of  these  two  parameters  is  sufficient  for  many  statistical  purposes, 
but  it  is  not  sufficient  for  the  analysis  of  collision  risk.  Indeed,  there  are 
a multitude  of  distributions  (Figure  4 shows  just  two  of  them)  that  possess 
the  same  mean  and  the  same  standard  deviation.  These  alternative  distri- 
butions will  in  general  provide  quite  different  answers  to  questions  about 
collision  risk;  for  collision  risk  analysis  by  its  very  definition  deals  with 
events  that  are  infrequent  and  altitude  deviations  that  are  extreme  (i.e.  far 
removed  from  the  mean).  As  can  be  seen  from  Figure  4,  the  proportion  of  times 
a deviation  greater  than  D is  observed  can  be  quite  different  for  the  two 
distributions,  even  though  they  possess  the  same  mean  and  the  same  standard 
deviation. 

In  the  RSS  method,  this  problem  is  resolved  by  making  the  additional 
assumption  that 

(5)  The  total  error  is  normally  distributed. 

This  assumption  is  not  unreasonable  in  light  of  the  Central  Limit  Theorem, 
which  essentially  states  that  under  fairly  general  conditions  the  sum  of  a 
sufficiently  large  number  of  independent  random  variables  is  closely  approx- 
imated by  a normal  random  variable.  With  this  assumption,  the  total  error 
distribution  is  now  completely  specified,  since  a normal  distribution  _i£ 
determined  by  its  mean  (0)  and  its  standard  deviation  (a) . 

A rather  crude  idea  of  "safe  separation"  can  now  be  found  using  the  probabi- 
lities of  extreme  deviations  for  normal  variables.  (A  more  detailed  analysis 
would  need  to  include  effects  related  to  the  traffic  pattern  and  density  of 
a given  airspace.)  Consider  two  aircraft  whose  nominal  altitudes  are  separated 
by  a distance  S and  both  of  which  have  a normally  distributed  vertical  position 
error  with  standard  deviation  a.  Then  actual  separation  between  tt^two 
aircraft  follows  a normal  distribution  having  mean  S and  variance  2a  (or 
standard  deviation  42  a).  Since  we  are  interested  in  situations  for  which  this 
altitude  difference  becomes  small,  we  are  concerned  only  with  the  left-hand 
tail  of  this  distribution.  To  assume  that  three  standard  deviations  provide 
adequate  safety  is  equivalent  to  assuming  for  this  case  that  the  risk  of  col-,, 
lision  will  be  acceptably  low  when  the  probability  is  less  than  0.135  percent 
that  vertical  separation  between  aircraft,  nominally  separated  by  S,  is  reduced 
to  zero. 

Thus  the  RSS  method  per  se  does  not  directly  lead  to  a collision  risk 
measure  as  defined  above.  However  the  assumption  of  normality  of  the  error 
distribution  can  readily  be  combined  with  analyses  such  as  that  described 
below  to  give  such  a measure.  The  correctness  of  the  normality  assumption 

4 

This  numerical  value  derives  from  the  fact  that  .00135  is  the  probability 
that  a normal  random  variable  is  smaller  than  its  mean  by  more  than  three 
standard  deviations.  This  value  applies  only  if  the  standard  deviation  o 
is  known. 
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is  critical,  and  must  be  validated  against  actual  data. 


3 . 2 The  Reich  Approach 

A detailed  collision  risk  model  for  analyzing  the  effects  of  separation 
standards  was  proposed  in  1966  by  Reich  [32,  33,  34]  and  has  been  subsequently 
modified  by  others  for  use  in  the  parallel  tracking  system  over  the  North 
Atlantic  [15,  43].  This  model  requires,  as  input,  estimates  of  such  parameters 
as  the  physical  dimensions  of  the  aircraft,  the  average  relative  speeds 
between  aircraft  in  the  three  directions  and  the  amount  of  congestion  within 
the  traffic  region.  In  addition,  the  model  requires  the  probabilities  of 
overlap  in  the  vertical,  lateral  and  longitudinal  directions,  such  values 
being  related  to  the  appropriate  separation  standard  under  consideration.  As 
output,  the  model  produces  a value  for  the  collision  risk,  measured  as  the 
expected  number  of  fatal  accidents  per  flying  hour  (where  each  collision  is 
counted  as  two  fatal  accidents).  It  is  the  variation  of  collision  risk,  as 
a function  of  the  separation  standard  being  studied,  that  is  of  major  interest 
in  the  evaluation  of  safe  separation  standards. 

As  considered  in  this  model,  each  aircraft  is  represented  as  a rectangular 

box  having  the  given  aircraft's  maximum  dimensions  of  length,  width  and 

height.  A collision  is  considered  to  have  occurred  between  two  aircraft  when 

they  are  flying  in  overlap  in  two  directions  (i.e.  they  are  separated  by 

less  than  an  aircraft's  dimension  in  those  directions)  and  an  overlap  then 

occurs  in  the  third  direction.  One  such  possibility  is  accounted  for  by  the 

term  N P , where  P is  the  probability  of  overlap  in  both  the  lateral  and 

vertical^iirections^ind  where  N is  the  number  of  times  an  overlap  occurs 

in  some  time  period  with  regard  to  the  longitudinal  direction.  Implicit  in 

this  expression,  already,  is  the  assumption  that  position  in  the  x direction 

is  independent  of  that  in  the  y and  z directions.  If  one  further  assumes  that 

all  three  coordinates  of  position  are  independent,  then  the  above  expression 

simply  becomes  N P P , where  P indicates  the  probability  of  overlap  in  the 
xvz  r 

r direction.  Because  there  are  two  other  possibilities  that  result  in  a 
collision,  the  collision  risk  between  a pair  of  aircraft  is  given  by  the  sum 
of  three  terms: 


(1)  Collision  Risk  =NPP  +NPP  + N P P . 

xyz  yxz  zxy 

Each  P needs  to  be  estimated  from  the  observed  distributions  of  positions 
in  the  r direction.  What  further  complicates  the  matter  is  the  fact  that 
the  N values  depend  not  only  on  the  flying  errors  in  direction  r,  but  also 
on  their  rates  of  change.  This  added  dependence  is  intuitively  reasonable 
since  the  number  of  overlaps  depends  on  both  the  probability  that  an  overlap 
occurs  and  the  average  duration  of  an  overlap.  Under  the  assumption  that 
the  velocity  r in  direction  r follows  a distribution  which  is  symmetric 
about  0,  and  that  position  and  velocity  are  independent,  Reich  derives  the 
approximation 

rn  p_ 

(2)  N « ^ ’ 


where  IT]  is  the  average  relative  speed  between  two  aircraft  in  direction  r, 
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and  X is  the  dimension  of  the  aircraft  in  direction  r.  For  simplicity,  it  is 
assumed  here  that  all  aircraft  have  the  same  dimension  X ; one  could  also 
interpret  X as  an  average  aircraft  dimension.  By  virtue  of  (2),  equation  (1) 
becomes 

(3)  Collision  Risk  - P P P ( il" ^ + — Ly^'  ) . 

x y z ZA  zx  zx 

x y z 

If  estimates  for  the  average  relative  velocities  [r]~  and  the  aircraft 
dimensions  X are  given,  then  all  that  remains  to  be  estimated  are  the  overlap 
probabilities  P . These  probabilities  are  in  turn  derived  from  the  total 
error  distributions  for  each  of  the  three  directions.  Just  as  in  the  RSS 
method,  the  value  of  P (especially  the  overlap  probability  in  the  direction 
corresponding  to  the  separation  standard  being  considered)  depends  crucially 
upon  the  form  assumed  for  the  total  error  distribution.  That  is  to  say, 
observations  in  the  "tails"  of  the  total  error  distribution  (extreme  deviations) 
are  overwhelmingly  important  in  the  calculation  of  these  overlap  probabilities. 
The  approach  taken  by  Reich  proceeds  by  first  making  a conservative  estimate 
of  the  tail  area  of  the  distribution.  Reich  then  models  the  shape  of  the 
tails  in  three  alternative  ways: 

(a)  The  pessimistic  spike,  which  places  the  entire  tail  area  at  a 
single  point  corresponding  to  the  intended  flight  path  of  the 
neighboring  aircraft, 

(b)  The  (conservative)  level  tails,  in  which  large  errors  are  assumed 

to  be  uniformly  distributed  (all  equally  likely  from  some  point  on) , 
with  the  limits  of  the  uniform  distribution  chosen  to  maximize 
the  probability  of  overlap, 

(c)  The  exponential  decay,  in  which  the  relative  frequencies  of  large 
errors  are  assumed  to  decrease  exponentially  with  magnitude. 

These  assumptions  about  the  shape  of  the  tails  (together  with  a fixed 
assumption  about  the  distribution  of  small  errors)  then  allow  overlap  proba- 
bilities, and  thereby  collision  risk,  to  be  calculated  for  each  of  the 
three  alternative  models.  (An  example  of  how  such  probabilities  can  be  de- 
rived from  the  total  error  distribution  is  given  in  Section  3.3,)  The  estimates 
obtained  under  assumptions  (a)-(c)  then  provide  a range  of  values  for  the 
collision  risk.  In  common  with  the  RSS  approach,  knowledge  about  the  precise 
shape  of  the  total  error  distribution,  and  in  particular,  the  shape  of  the 
tails,  is  required  before  confident  statements  can  be  made  about  the  actual 
magnitude  of  the  collision  risk. 

As  it  stands,  the  expression  (3)  for  collision  risk  is  appropriate 
only  for  a pair  of  aircraft,  whose  respective  flying  errors  are  assumed  to 
be  independent  of  one  another.  Reich  also  extended  the  analysis  from  a pair 
of  aircraft  to  an  entire  traffic  region,  using  assumptions  about  the  air- 
space configuration  and  traffic  densities.  The  result  of  this  extension 
turns  out  to  be  the  adjunction  of  another  multiplicative  factor  to  the  expression 
in  (3). 


-23- 


Although  the  RSS  and  Reich  methods  seem  to  be  two  entirely  different  and 
separate  approaches,  they  are  not  necessarily  inconsistent.  In  fact  some 
combination  of  the  best  features  of  both  methods  may  be  possible,  since  they 
address  different  parts  of  the  problem.  The  RSS  method  focuses  on  the  cal- 
culation of  the  distribution  of  total  vertical  error  from  component  errors.  The 
Reich  model  focuses  on  the  evaluation  of  collision  risk  from  knowledge  of  the 
distributions  of  errors  in  each  of  the  three  directions.  One  could  therefore 
use  the  RSS  method  (or  some  other  method  of  combining  individual  component 
errors)  to  calculate  the  vertical  error  distribution,  and  then  use  that 
distribution  as  input  to  the  Reich  collision  risk  analysis.  Such  a procedure 
capitalizes  on  advantages  inherent  in  both  methods:  namely,  it  relates  the 
risk  of  collision  to  component  errors,  thus  allowing  the  evaluation  of  changes 
in  the  performance  of  components,  and  it  contains  a direct  and  specific 
analysis  leading  to  the  calculation  of  collision  risk  (unlike  the  RSS  method). 
This  hybrid  approach  also  tends  to  avoid  the  failings  of  the  two  individual 
methods,  and  is  therefore  a strong  candidate  for  further  investigation  once 
data  concerning  the  error  distributions  are  available. 


3.3  Analysis  of  the  Tails  of  Distributions 

As  noted  previously,  the  RSS  and  Reich  approaches  are  actually  comple- 
mentary. The. first  attempts  to  synthesize  a total  error  distribution  from 
component  errors.  The  second  approach  requires  as  input  the  total  error 
distribution  and  produces  information  about  the  risk  of  aircraft  collision. 

In  both  cases  it  becomes  apparent  that  it  is  the  extreme  deviations  (out  in 
the  tails  of  the  distribution)  that  are  important,  and  not  the  small  or 
moderate-sized  deviations. 

Another  way  to  see  that  the  effect  of  the  tail  shape  can  be  crucial 
is  by  considering  two  aircraft  over  the  same  geographic  point  on  the  earth 
and  nominally  separated  by  S feet  in  the  vertical  direction.  Suppose  further, 
as  seems  reasonable,  that  both  aircraft  are  subject  to  the  same  total  vertical 
error  distribution  f(x).  Then  the  probability  of  vertical  overlap  (i.e.  the 
probability  that  the  separation  between  the  two  aircraft  is  less  than  h,  the 
vertical  dimension  of  an  average  aircraft)  is  given  by 

« t+h 

P(h)  =_/  f(t)  [t/h  f(y-S)  dy]  dt, 

which  upon  using  the  substitution  v = -y+t+S  becomes 

oo  S+h 

P(h)  = JL  f S-h  f(t-v)dv]  dt. 

Since  h is  small  relative  to  S,  the  term  in  brackets  above  can  be  approximated 
by  2h  f(t-S)  and  so 


P(h)  = 2h  / f(t)  f(t-S)  dt. 

— OO 

If  the  distribution  f is  only  moderately  spread  out  relative  to  S,  then  at 
least  one  of  the  values  of  t and  t-S  which  appear  in  the  product  will  be  out 


in  a tail  of  the  distribution.  In  other  words,  the  shape  defined  by  the  tails 
of  the  distribution  will  have  a considerable  effect  on  the  value  of  P(h), 
the  overlap  probability. 

It  has  been  reported  by  several  sources  [29],  [30]  that  the  observed  tails 
appear  to  be  fatter  than  one  would  expect  from  a normal  distribution.  If  this 
is  the  case,  assumption  (5)  of  Section  3.1  does  not  hold  and  the  3 standard 
deviations  used  by  the  RSS  method  may  contain  significantly  less  of  the  total 
distribution  than  the  99.7  percent  contained  within  3 standard  deviations 
from  the  mean  of  a normal  distribution.  To  obtain  an  equivalent  proportion 
of  a fatter-tailed  distribution,  it  would  be  necessary  to  include  more  than 
3 standard  deviations,  thus  increasing  (perhaps  critically)  the  acceptable 
separation  standard.  However,  in  order  to  assess  the  appropriate  factor  by 
which  to  multiply  the  standard  deviation  in  order  to  include  99.7  percent  of 
the  distribution,  it  is  necessary  to  know  what  the  distribution  is.  This  ne- 
gates one  of  the  advantages  claimed  for  the  RSS  approach,  namely  not  having  to 
know  the  actual  distribution.  A more  thorough  study  of  the  tails  of  the  error 
distribution  is  clearly  necessary  since  so  much  of  the  analysis  depends  on 
this  critical  information. 


3. A Convolution  of  Distributions 


In  describing  the  RSS  method,  it  was  noted  that  the  precise  shapes  or 
forms  of  the  component  distributions  are  not  required.  Rather,  only  the 
values  of  the  component  error  standard  deviations  are  needed,  together  with  the 
requirement  that  there  be  "enough"  component  errors  for  the  Central  Limit 
Theorem  to  apply.  The  result  is  that  the  total  error  distribution  is  approx- 
imately normal,  with  a calculable  mean  and  standard  deviation. 

There  has  been  some  concern  that  the  total  error  is  not  in  practice 
normally  distributed.  Therefore  it  is  appropriate  to  consider,  as  an  alter- 
native, combining  known  component  distributions  to  give  an  analytic  description 
of  the  total  error  distribution.  The  statistical  method  for  doing  this  is 
termed  the  method  of  convolution  [18,  pp.  187-188]. 

This  procedure  makes  use  of  the  precise  (assumed)  forms  of  the  component 
distributions  in  producing  an  exact  expression  for  the  total  error  distribution. 
Again,  certain  assumptions  must  obtain  before  the  method  can  be  used;  namely, 
assumptions  (1)  through  (3)  of  Section  3.1  are  presumed  to  hold,  and  in  place 
of  assumption  (A)  the  following  stronger  assertion  is  made: 

(A*)  The  distribution  of  each  individual  error  's  known. 

To  illustrate  the  method,  consider  the  case  of  two  component  errors  X 
and  X having  distributions  f (x)  and  f2(x),  respectively.  Then  the  probabi- 
lity density  function  f for  the  variable  X=X^+X  is  called  the  convolution,  of 
fj  and  f^  and  is  given  (assuming  independence)  By 

oo 

f(x)  = _/  fx(t)  f2(x-t)  dt. 

This  relation  can  be  generalized  so  that  the  distribution  for  X=Xj+X-+. . .+Xn 
will  be  found  using  repeated  convolution  operations.  For  example,  tne  con- 
volution of  two  rectangular  distributions  is  found  to  be  in  general  a trape- 
zoidal distribution  (see  Figure  5).  Also,  the  convolution  of  two  normal 
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distributions  is  again  a normal  distribution. 

When  the  component  distributions  are  more  complex  and  when  a number  of 
component  distributions  must  be  combined  by  convolution,  it  is  difficult  to 
find  an  exact  analytical  form  for  the  composite  error.  An  alternative  pro- 
cedure is  to  use  Monte  Carlo  methods  to  sample  from  the  individual  dis- 
tributions and  thus  generate  an  approximation  to  the  total  error  distri- 
bution. We  did  this  using  representative  values  for  the  parameters  of  the 
component  distributions  (with  shapes  as  specified  by  the  Panel  on  Vertical 
Separation  of  Aircraft  [25]).  The  resulting  combined  distribution  appeared 
for  all  purposes  to  be  normal.  In  fact,  a number  of  statistical  tests  for 
normality  were  applied^and  none  of  these  gave  any  reason  to  reject  the  hy- 
pothesis of  normality.  Moreover,  the  total  error  was  fitted  by  a normal 
distribution  better  than  any  other  chosen  from  a large  family  of  possible 
symmetric  distributions  (including  the  logistic,  double  exponential  and 
Cauchy  distributions).  These  observations  remained  true  for  different 
choices  of  parameter  values,  taken  from  the  ranges  given  in  Tables  1-4  of 
Section  2.5. 

To  explore  by  Monte  Carlo'  methods  the  effects  of  convoluting  distri- 
butions of  the  types  shown  in  Figure  3,  several  computer  runs  were  made  con- 
voluting a single  normal  distribution  with  a single  rectangular  distribution, 
varying  the  ratio  of  the  standard  deviations  of  the  two  distributions.  As 
long  as  the  standard  deviation  of  the  rectangular  distribution  was  approximately 
equal  to  or  less  than  that  of  the  normal  distribution  (ratios  of  1,  1/2,  1/4, 
1/8,  1/164  were  tried),  then  the  resulting  distribution  was  essentially 
normal.  When  the  standard  deviation  of  the  rectangular  was  increased  to  be 
significantly  greater  than  that  of  the  normal  (ratios  of  2 and  4 were  run), 
the  convolution  was  not  normal  but  had  shorter  tails  than  a normal  distri- 
bution. 

More  emphatically,  it  is  shown  in  Appendix  A that,  according  to  the 
definition  used  there  for  comparing  tail  lengths,  the  convolution  of  a normal 
and  a rectangular  distribution  must  have  shorter  tails  than  normal.  Moreover, 
the  general  result  given  in  Appendix  A guarantees  that  the  convolution  of 
a normal  distribution  with  any  bounded  probability  density  function  having 
a finite  range  also  must  have  shorter  tails  than  normal.  In  particular,  this 
result  implies  that  if  the  distributions  to  be  convoluted  consist  primarily 
of  normal  and  rectangular  distributions  (as  is  assumed  in  most  of  the  ICAO 
documentation),  then  the  resulting  distribution  will  either  be  approximately 
normal  or  have  shorter  tails  than  a normal  distribution  (with  the  same  standard 
deviation) . 

The  processes  most  likely  to  introduce  distributions  with  longer  tails  than 
normal  are  the  human  actions  in  which  large  blunders  might  occur .including 


The  statistical  computer  programs  used  are  more  fully  described  in  James 
J.  Filliben,  "DATAPAC:  A Data  Analysis  Package",  to  appear  in  Proceedings  of 
Computer  Science  and  Statistics  (9th  Symposium  on  Interface),  April  1976, 
Harvard  University,  Cambridge,  Mass. 
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inattentive  flying  procedures  by  the  pilot  and  missetting  of  the  standard 
atmosphere  by  the  pilot.  The  first  of  these,  usually  called  "flight  tech- 
nical error",  refers  to  the  pilot's  ability  and  inclination  to  maintain  the 
assigned  altitude.  This  error  is  decreased  when  altitude-hold  equipment 
is  used,  since  pilot  inattentiveness  is  no  longer  a factor.  As  already 
noted,  however,  there  may  be  errors  when  altitude-hold  is  initiated,  and 
altitude-hold  is  usually  disengaged  during  turbulent  conditions.  The 
second  factor,  missetting  the  standard  atmsophere,  is  often  considered  part 
of  pitot-static  error,  but  is  included  here  because  it  too  is  a human 
failure  which  can  result  in  gross  position  error. 


3.5  Examination  of  the  Model  Assumptions 

From  the  previous  section  it  can  be  seen  that  the  assumption  of  normality 
used  in  the  RSS  method  appears  to  be  consistent  with  the  Monte  Carlo  results 
based  on  parameter  values  from  Tables  1-4,  the  other  assumptions  on  which 

this  convolution  approach  is  based  namely  (1),  (2),  (3),  (4*)  are 

correct.  Since  some  evidence  exists  [29,  30]  to  suggest  that  the  total  error 
distribution  is  not  in  practice  normally  distributed  (especially  in  the  tail 
areas),  it  is  necessary  to  examine  the  validity  of  these  assumptions  and 
see  whether  alternative  ones  are  more  reasonable. 

Assumption  (1),  the  assumption  that  the  component  errors  are  distributed 
independently  of  one  another,  may  not  necessarily  hold.  In  fact,  it  does  not 
seem  unlikely  that  some  of  the  errors  referring  to  the  more  detailed  components 

of  the  height-keeping  system  are  dependent  e.g.  the  friction  and  backlash 

errors.  It  would  be  quite  difficult,  without  much  more  information,  to 
model  mathematically  the  effects  of  such  possible  dependencies.  Accordingly, 
a more  reasonable  approach  is  to  combine  together  certain  groups  of  errors 
in  order  to  obtain  a collection  of  errors  that  are  for  the  most  part  inde- 
pendent. For  example,  aggregation  into  the  broad  categories  of  static  pressure 
system  error,  altimeter  error  and  pilot  response  error  would  achieve  a fairly 
high  degree  of  independence.  Moreover,  it  is  probable  that  data  on  height- 
keeping errors  could  for  the  most  part  be  obtained  at  roughly  this  level  of 
aggregation,  rather  than  a finer  one. 


Assumption  (2)  reflects  the  belief  that  individual  errors  combine 
simultaneously  and  additively.  While  such  an  assumption  about  the  errors 
appears  to  be  a good  initial  approximation  to  the  truth,  there  are  alternative 
approaches  to  modeling  the  combination  of  errors.  Several  of  these  are  mentioned 
below: 


(a)  Errors  may  vary  from  aircraft  to  aircraft  and  crew  to  crew.  For 
example,  any  individual  aircraft  may  experience  a total  error 
which  is  distributed  normally  with  mean  0 and  standard  deviation 
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o.  Yet  the  parameter  o may  vary  from  one  aircraft/crew  configuration 
to  another,  and  so  it  may  be  reasonable  to  assume  that  o itself 
follows  a probability  distribution  [5,  27].  The  resulting  observed 
error  distribution,  based  on  a sample  of  different  aircraft,  may 
not  resemble  the  error  distribution  of  any  individual  aircraft. 

(b)  The  total  error  may  in  fact  be  a mixture  of  several  parts.  For 
example,  total  error  might  be  considered  as  normally  distributed 
under  usual  conditions.  Furthermore,  suppose  there  is  some  proba- 

, bility  of  a blunder  occurring,  where  the  magnitude  of  the  blunder 
follows  some  other  distribution.  Then  the  distribution  of  total 
error  will  be  determined  by  a weighted  average  of  the  two  given 
distributions  [11,  26]. 

(c)  It  is  possible  that  certain  error  components  are  in  fact  time- 
varying  quantities.  For  example,  some  of  the  errors  may  occur  only 
during  certain  phases  of  flight  or  may  be  applicable  only  while 
certain  equipment  is  operating  (or  not  operating). 

Assumptions  (3)  and  (4*)  are  also  important,  requiring  that  all  reasonable 
sources  of  error  have  been  identified  and  that  knowledge  about  their  proba- 
bilistic behavior  is  available.  A carefully  designed  data  collection  effort 
(especially  one  geared  toward  the  measurement  of  somewhat  aggregated  error 
components)  can  help  to  ensure  that  these  assumptions  hold,  at  least  approxi- 
mately. 


3.6  Choice  of  Model 


It  is  clear  from  the  discussion  above  that  further  modeling  awaits  a 
structured  planned  data  collection  effort  designed  to  permit  fuller  under- 
standing of  the  actual  shapes  of  the  tails  of  the  vertical  error  distribution 
and  the  tail  distributions  of  the  larger  error  components,  particularly  flight 
technical  and  other  human  errors.  A review  of  previous  attempts  at  gathering 
data  for  this  purpose  shows  many  pitfalls,  among  them  the  difficulty  in 
identifying  (after  the  fact)  the  assigned  altitude  and  when  an  aircraft  is 
actually  in  level  flight,  the  problem  of  identifying  actual  pressure  altitude, 
and  the  need  for  collecting  a large  sample  of  data  which  covers  a variety 
of  aircraft  types  and  crews. 

Once  such  a data  sample  is  available,  choice  of  model  may  in  part  be 
determined  by  measures  of  fit  to  these  data.  One  might,  for  example,  choose 
the  total  error  distribution  based  on  one  of  the  following  families  of 
distributions:  Johnson  S , Pearson  Type  VII,  Tukey  X or  generalized  exponen- 

tial. All  of  these  families  include  a variety  of  individual  distributions, 
with  differing  characteristics  obtained  by  varying  parameters  in  the  distribu- 
tion [17,  18].  In  each  case,  the  particular  member  of  the  family  represented 
by  the  observations  may  be  found  by  estimating  the  values  of  those  parameters 
best  fitting  the  data. 


Two  other  modeling  approaches,  also  involving  data  fitting,  have  been 
proposed.  The  first  involves  imagining  two  types  of  flights,  having  two 
distinct  error  distributions.  One  is  the  usual  flight  where  some  errors 
occur  but  nothing  untoward  happens,  and  whose  error  distribution  is  normal. 

The  other  is  a "blunder  flight"  whose  error  distribution  is  totally  different, 
perhaps  bimodal,  and  has  a much  greater  standard  deviation.  Blunder  flights 
occur  a certain  (determined  from  observed  data)  fraction  of  the  time.  The 
total  distribution  becomes  a weighted  average  of  the  two  types  of  distributions 
(weighted  by  the  fraction  of  flights  falling  into  each  category) . 

( 

In  the  second  approach,  it  is  assumed  that  all  aircraft  errors  follow 
the  same  type  distribution,  usually  the  normal,  but  that  one  of  the  parameters, 
say  the  standard  deviation,  varies  from  aircraft  to  aircraft  following  a 
second  distribution.  For  example,  the  Burgerhout  distribution  results  when 
the  individual  aircraft  errors  are  normal  with  mean  0 and  standard  deviation 
a and  when  a itself  varies  according  to  a folded  normal  distribution  [17] 
with  mean  p and  standard  deviation  o^.  Other  combinations  of  distributions 
are  possible,  and  if  the  data  were  available  one  might  determine  the  most 
desirable  distribution  type,  again  by  applying  data  fitting  techniques  to 
select  a "best"  member  from  some  general  family  of  distributions. 


4.  DATA  REQUIREMENTS 


In  order  to  test  model  assumptions  and  to  evaluate  the  reasonableness  of 
the  various  modeling  approaches,  it  will  be  necessary  to  obtain  additional 
data,  since  currently  available  sources  are  inadequate  for  these  tasks.  More 
specifically,  a data  collection  ef'ort  is  needed  in  order  to  specify  the  dis- 
tributions of: 

total  vertical  error, 
static  pressure  system  error, 
altimeter  instrument  error,  and 
pilot  response  error. 

It  may  be  possible  to  obtain  static  pressure  system  error  and  altimeter 
instrument  error  data  from  controlled  laboratory  experiments,  since  both 
are  basically  errors  in  equipment  performance.  By  contrast,  the  total  error 
and  the  pilot  response  error  will  require  field  observations  using  airborne 
aircraft.  Since  information  is  required  on  extreme  or  gross  deviations, 
the  set  of  observations  must  be  quite  large  in  order  to  provide  enough  data 
points  in  the  tails  of  the  distributions  to  allow  estimating  the  size  and 
shape  of  those  tails.  This  implies  that  data  collection  will  unavoidably  be 
expensive.  Careful  design  of  the  data  gathering  effort  will  thus  be  necessary, 
to  permit  collection  of  sufficient  data  at  a reasonable  cost.  Precautions 
must  be  taken  to  ensure  the  usefulness  of  each  piece  of  data  collected,  and 
to  ensure  that  no  important  factors  are  overlooked.  The  data  collection  must 
also  be  designed  to  aid  in  further  modeling  and  choice  of  model,  by  facili- 
tating the  checking  of  model  assumptions. 

This  section  will  include  a discussion  of  many  of  the  issues  which 
should  be  considered  in  the  design  of  a data  collection  effort.  These 
issues  are  presented  from  the  point  of  view  of  the  analyst  who  desires  as 
complete  and  carefully  specified  a data  set  as  possible,  and  this  section 
does  not  explicitly  address  the  budgetary  or  feasibility  problems  of  ob- 
taining such  data.  Thus  these  remarks  describe  an  ideal  goal  towards  which 
any  data  collection  effort  should  strive.  Such  remarks  should  serve  as  a 
vehicle  to  stimulate  discussion  of  the  kinds  of  data  needed  and  possible 
methods  of  obtaining  them,  but  they  should  not  be  taken  as  requirements. 

Rather  a careful  design  must  balance  the  desirable  characteristics  described 
below  against  technical  feasibility  and  budgetary  and  manpower  constraints, 
with  the  objective  of  finding  an  acceptable  middle  ground. 

4 . 1 Avoiding  Possible  Problems  in  Data  Collection 

Previous  data  collection  efforts  have  encountered  several  problems  in 
obtaining  the  desired  numbers  and  in  interpreting  the  information  after  it  was 
gathered. 

One  of  these  problems  is  the  identification  of  the  flight  level  to  which 
a given  aircraft  was  actually  assigned.  Actual  flight  level  flown  and 
assigned  flight  level  must  be  obtained  from  separate  data  sources,  and  the 
two  pieces  of  information  must  be  coordinated  in  time.  Analyses  which  infer 
assigned  flight  level  from  that,  actually  flown  (by  using  the  closest  1000  foot 
level)  will  fail  to  capture  truly  gross  deviations  from  assigned  flight  level. 
It  is  therefore  necessary  to  collect  flight  level  assignments  along  with 
actual  height  flown  in  order  to  assess  error  magnitudes  accurately. 


Similarly,  those  analyses  which  infer  controller  intervention  if  air- 
craft depart  significantly  from  planned  course  or  flight  level  will  also  miss 
gross  deviations.  For  example,  aircraft  flying  at  an  even  flight  level  (odd 
flight  levels  are  usually  assigned  above  FL290)  cannot  be  presumed  to  have 
been  assigned  there  by  a controller.  Again  it  is  necessary  to  know  what  the 
controller's  actions  are,  and  therefore  it  is  valuable  to  collect  data  both 
on  actual  performance  and  on  the  controller's  directions  to  pilots. 


Several  other  pieces  of  information  must  be  collected  about  each  flight 
for  which  height-keeping  performance  is  to  be  analyzed.  In  particular,  air- 
craft type  and  altimeter  type  must  be  recorded  in  order  to  evaluate  the  effects 
of  differences  in  performance  among  aircraft  on  the  error  distributions.  It 
is  also  desirable  to  know  whether  the  altitude-hold  equipment  was  or  was 
not  in  force,  since  pilot  response  error  will  be  affected  by  the  use  of  such 
equipment.  Further,  it  is  useful  to  know  if  weather  conditions  are  stable 
or  changing,  and  if  barometric  pressure  is  varying,  thus  causing  variation 
in  pressure  altitude.  When  turbulence  exists,  as  in  a thunderstorm,  then  this 
condition  will  affect  ability  to  measure  pressure  accurately  and  to  maintain  an 
equal  pressure  contour.  All  of  these  auxiliary  data  factors  should  be  col- 
lected in  conjunction  with  and  at  the  same  time  as  the  actual  aircraft  altitude, 
to  permit  evaluating  the  (possibly  systematic)ef fects  of  these  factors.  (Other 
such  systematic  error  factors  are  discussed  in  the  next  section.) 

A final  problem  in  collecting  data  is  the  difficulty  of  identifying  the 
pressure  altitude  flown.  Although  ground  stations  can  monitor  actual  altitude 
(height  above  sea  level)  quite  accurately  using  radar,  the  aircraft  is  not 
assigned  to  an  actual  height  but  rather  to  an  equivalent  pressure  altitude. 

The  two  would  be  the  same  only  if  the  standard  atmospheric  pressure  were  the 
true  reference  pressure.  Obtaining  actual  ambient  air  pressure  at  the  air- 
craft's altitude  appears  to  require  special  instrumentation  whose  use  is  not 
only  expensive  but  also  defeats  the  aim  of  obtaining  data  on  the  usual  re- 
sponse of  pilots  (who  therefore  should  not  know  they  are  being  specially 
monitored) . Some  method  must  be  devised  for  obtaining  the  actual  barometric 
pressure  at  given  altitudes  in  order  to  establish  true  pressure  altitude 
flown. 

None  of  these  problems  should  prove  insurmountable,  but  all  require 
careful  consideration  and  should  be  taken  into  account  in  designing  the  data 
collection  effort.  Anticipation  of  these  problems  and  provision,  prior  to 
data  gathering,  of  means  for  overcoming  them  will  contribute  greatly  to  the 
success  of  the  collection  task  and  the  usefulness  of  its  product. 


4 . 2 Consideration  of  Factors  Causing  Systematic  Errors 

As  noted  above,  the  design  of  the  data  collection  effort  must  take  into 
account  subsidiary  factors  which  can  systematically  influence  the  results. 

Data  should  be  recorded  over  the  whole  range  of  values  for  such  a factor, 
to  ensure  that  the  observations  recorded  are  properly  representative.  A pre- 
liminary list  of  such  factors  appears  in  Table  5,  in  approximately  their 
expected  order  of  importance  or  effect. 

The  type  of  altimeter  certainly  has  an  effect  on  instrument  performance, 
and  so  it  is  necessary  to  include  data  gathered  from  the  different  altimeter 
types  in  use  above  FL290,  at  the  least  Types  II  (precision)  and  III  (servo- 
corrected)  which  are  described  in  Section  2.  There  may  also  be  some  variation 
by  manufacturer,  so  data  should  be  taken  from  several  manufacturers'  instru- 
ments. If  altimeter  type  is  the  same  for  all  of  a particular  model  of  aircraft 
(or  aircraft  type  and  airline),  one  need  consider  only  the  latter  in  the 
design  of  the  data  collection.  Aircraft  type  must,  however,  be  taken  into 
account  since  different  aircraft  have  different  shapes  and  different  locations 
for  the  static  pressure  sources,  leading  possibly  to  different  error  character- 
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TABLE  5 


Factors  Which  Can  Cause  Systematic  Errors 

1.  Altimeter  type 

2.  Aircraft  type 

3.  Altitude-hold  equipment  in  use 

4.  Meteorological  conditions 

5.  User  class 

6.  Crew  and  aircraft  variability 

7.  Altitude  , 

8.  Calibration  cycle 

9.  Age  of  aircraft 

10.  Surveillance/control  system 

11.  Traffic  density 


t 


istics.  Care  must  be  taken  that  the  aircraft  types  sampled  are  representative 
of  those  generally  found  above  FL290. 


Since  altitude-hold  eliminates  many  of  the  human  error  sources,  it  is 
desirable  to  have  data  collected  both  with  and  without  this  equipment  in 
operation.  Furthermore,  it  is  desirable  that  the  twq  situations  be  represented 
in  the  data  set  according  to  their  relative  frequencies  of  occurrence,  or  at 
least  one  should  be  able  to  estimate  what  these  relative  frequencies  are. 

Meteorological  conditions,  particularly  any  turbulence  or  abrupt  changes 
in  barometric  pressure,  also  affect  altitude  measurements.  Altitude-hold 
is  usually  disengaged  during  turbulence,  since  this  equipment's  efforts  to 
follow  an  equal  pressure  contour  may  lead  under  ’such  conditions  to  rather 
large  height  fluctuations  in  a short  time  span.  Poor  weather  conditions 
require  greater  attention  by  the  pilot  to  his  instruments,  providing  less 
opportunity  for  attentiveness  to  any  one  of  them  and  perhaps  leading  to  greater 
altitude  deviations.  On  the  other  hand,  since  good  weather  allows  visual 
observation  of  other  aircraft,  pilots  may  be  less  attentive  under  such  condi- 
tions than  ai  times  when  visibility  is  poor.  These  various  speculations 
highlight  the  necessity  for  data  to  be  gathered  under  varying  meteorological 
conditions  to  ensure  that  effects  of  those  conditions  can  be  evaluated  . 

The  majority  of  aircraft  at  altitudes  above  FL290  are  those  of  commercial 
air  carriers,  but  military  aircraft  also  operate  in  these  altitudes  as  do 
some  general  aviation  aircraft.  Each  user  class  is  likely  to  have  its  own 
equipment  and  procedures  for  calibrating  that  equipment.  In  addition  there 
are  likely  to  be  differences  in  pilot  flying  hours  and  flight  frequency. 

All  these  differences  combine  to  suggest  possible  systematic  variation  in 
height-keeping  error  among  the  three  classes  of  users. 

In  an  effort  to  collect  d--ta  on  actual  vertical  errors  it  is  desirable 
to  take  into  account  the  variability  among  equipment  and  crews:  in  particular, 
the  variability  for  the  same  crew  on  different  flights  and  the  variability 
for  the  same  aircraft  with  different  crews.  It  will  of  course  not  be  sufficient 
to  have  data  relating  only  to  one  crew  or  only  to  one  aircraft.  Thus,  for 
instance,  a design  which  relies  on  a single  heavily  instrumented  aircraft  will 
not  provide  sufficient  data  to  resolve  the  many  questions  about  altitude  error. 

Another  factor  to  be  considered  in  planning  the  data  collection  effort 
is  altitude  itself.  Clearly  all  data  must  refer  to  aircraft  flights  whose 
assigned  altitude  is  above  FL290,  but  it  is  desirable  that  several  different 
altitudes  within  that  range  are  represented.  For  example,  each  aircraft  type 
is  designed  to  operate  most  efficiently  in  a particular  altitude  range, 
and  thps  the  pilqt  usually  requests  clearance  to  fly  at  an  assigned  altitude 
in  that  range.  In  addition,  air  traffic  control  procedures  assign  aircraft 
flying  in  opposite  directions  to  different  flight  levels.  Accordingly,  if  data 
are  recorded  only  on  aircraft  flying  at  one  flight  level  (and  hence  in  only 
one  direction)  the  effects  of  prevailing  wind  patterns  (such  as  the  jet  stream) 
may  not  properly  be  accounted  for.  Therefore  several  altitude  levels  should 
e represented  in  the  data  set. 
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The  precision  of  most  equipment  deteriorates  with  age.  Calibration  is 
designed  to  reverse  this  process,  at  least  partially,  by  resetting  the  in- 
strument so  that  certain  test  measurements  are  made  accurately.  The  calibra- 
tion cycle  (i.e.,  the  time  between  successive  calibration  tests)  thus 
has  an  effect  on  the  magnitude  of  instrument  errors.  Since  calibration  pro- 
cedures are  largely  a matter  of  the  individual  owner's  choice  (as  long  as 
minimum  standards  are  met),  the  actual  calibration  practices  can  affect  the 
quality  of  height-keeping.  Therefore  it  is  desirable  that  the  data  set  in- 
clude operators  with  different  calibration  procedures,  and  aircraft  at  different 
points  in  the  calibration  cycle. 

The  age  of  the  aircraft  itself  may  have  some  effect  on  height-keeping 
error.  As  noted  in  Section  2's  description  of  the  static  pressure  system, 
skin  deformations  or  dents  in  the  neighborhood  of  the  static  pressure  opening 
can  significantly  affect  the  pressure  measurement;  such  deformations  become 
more  likely  with  age.  To  the  extent  that  aircraft  types  change  with  time, 
aircraft  type  may  be  a fairly  good  indication  of  the  age,  so  that  data  on 
age  of  specific  aircraft  may  not  be  required. 

The  presence  or  absence  of  an  independent  surveillance  system  can  affect 
the  pilot's  perception  of  acceptable  height  deviations  and  thus  influence  the 
magnitude  of  pilot  response  errors.  Radar  surveillance  covers  all  of  CONUS 
(Continental  U.  S.)  but  high-traffic  oceanic  areas,  such  as  the  North  Atlantic 
or  the  area  between  the  West  Coast  of  the  U.S.  and  Hawaii,  do  not  have  radar 
coverage;  controllers  must  rely  on  pilot  position  reports  in  these  regions. 
Different  lateral  and  longitudinal  separations  are  required  over  the  ocean, 
but  the  vertical  separation  rules  are  the  same  in  all  areas,  regardless  of  the 
availability  of  surveillance  and  navigational  systems.  En  route  radar  displays 
have  JLight  level  appearing  on  the  radar  scope  for  any  aircraft  with  an  oper- 
ating Mode  C transponder,  but  controllers  do  not  continuously  monitor  altitude 
as  they  do  position.  Their  intermittent  and  advisory  monitoring  may,  however, 
aid  in  preventing  gross  altitude  deviations  and  situations  in  which  collision 
is  imminent.  Thus  it  is  reasonable  to  expect  that  the  presence  or  absence  of 
a surveillance  system  may  affect  the  distribution  of  vertical  position  error, 
and  should  be  considered  in  the  data  collection  design. 

Traffic  density  is  ultimately  reflected  in  the  Reich  model  through  the 
factors  P , P and  P , since  the  probability  of  losing  separation  in  one  of 
the  threexdir^ctionsZis  in  part  a function  of  how  often  aircraft  are  directly 
behind  one  another  on  the  same  track,  pass  on  adjacent  tracks,  or  pass  on 
adjacent  flight  levels  of  the  same  track. 


In  addition  to  these  effects  of  traffic  density,  the  pilot's  knowledge  of 
the  proximity  of  other  aircraft,  from  radio  reports  or  sightings,  may  affect 
his  attentiveness  and  adherence  to  assigned  flight  level.  Therefore  traffic 
density  can  have  an  effect  on  the  error  magnitudes,  and  data  on  this  factor 
will  be  required  for  use  in  the  Reich  model. 


The  various  factors  listed  in  Table  5 can  each  cause  systematic  variations 
in  the  distribution  of  vertical  position  error  and  in  one  or  more  of  the  com- 
ponent error  factors.  Thus  a good  data  collection  design  will  ensure  that 


m 
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the  effort  includes  representative  values  for  each  factor  and  combinations 
of  factors  that  are  important  at  the  altitudes  of  interest. 

While  it  may  be  economically  prohibitive  to  include  all  relevant  factors 
in  the  experimental  design,  at  least  the  three  major  ones  — aircraft  type, 
altitude-hold  in  use,  and  meteorological  conditions  — should  be  addressed. 
Surrogates  for  factors  not  included  directly  (airline  and  aircraft  type  for 
altimeter  type,  as  an  instance)  can  perhaps  be  used  when  necessary  to  ensure 
representation  of  other  factors,  and  biases  in  the  collected  data  set  should 
be  recognized  during  analysis  of  those  data. 


4 . 3 Testing  Model  Assumptions 

The  data,  once  collected,  must  be  analyzed  to  determine  how  representative 
a sample  has  been  drawn.  In  particular,  it  can  be  judged  how  well  the  data 
reflect  the  types  of  situations  usually  encountered  in  the  environment  being 
considered  and  to  what  extent  the  various  modeling  assumptions  noted  earlier 
hold.  The  two  main  model  assumptions  to  be  tested  are:  that  component  errors 
are  independent,  and  that  the  distribution  of  total  error  (and  in  particular 
its  tails)  is  normal.  As  a first  test  for  the  independence  of  the  three 
component  errors  ( i.e.,  to  check  that  the  errors  in  one  component  are  not 
associated  with  errors  in  another) , one  would  compute  the  correlation  co- 
efficients between  all  pairs  of  components.  If  a coefficient  is  near  +1 
or  -1,  the  two  factors  display  a high  degree  of  linear  association;  if  the 
coefficient  is  near  0,  tne  two  factors  display  very  little  association  or 
correlation  with  one  another.  Other  statistical  measures  or  tests  may  also 
be  used  to  establish  the  degree  of  association  between  the  component  errors. 

The  assumption  of  normality  of  the  tails  may  be  investigated  by  plotting 
the  distribution  on  probability  graph  paper  and  comparing  the  resulting 
curve  with  a straight  line.  Several  test  statistics,  such  as  the  ratio  of 
the  mean  deviation  to  the  standard  deviation,  the  sample  skewness  and  the  sample 
kurtosis  [17]  can  be  computed  and  compared  with  known  values  of  those  sta- 
tistics for  a normal  distribution.  In  addition,  one  may  use  regression  to 
fit  the  observed  total  error  distribution  within  a general  family  of  distribu- 
tions that  includes  the  normal  distribution  for  certain  values  of  the  para- 
meters, and  see  how  closely  the  "best-fit"  parameter  values  resemble  the 
"normal  distribution"  values.  Most  of  these  procedures  are  easily  available 
using  present  statistical  computation  packages,  so  that  testing  for  independence 
of  the  component  errors  and  normality  of  the  total  (or  a component)  error 
distribution  is  a relatively  straightforward  task  once  data  are  available. 

Thus  a variety  of  statistical  procedures  can  be  performed  on  the  data  set 
once  it  is  collected,  and  before  it  is  used  in  modeling. 
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5.  CONCLUSION 


In  this  report  we  have  discussed  several  approaches  to  evaluating  vertical 
separation  standards  for  use  above  FL290.  Various  models  have  been  proposed 
to  aid  such  an  evaluation;  choice  among  them  rests  in  part  on  how  well  they 
meet  the  following  criteria: 

1.  The  model  should  be  capable  of  reflecting  changes  in  the  system. 

I 

2.  The  model  should  relate  system  characteristics,  including  separation 
standards,  to  some  measure  of  system  safety. 

3.  The  model  must  be  "computable",  relying  on  quantifiable  measures 
and  functions. 

4.  The  data  required  as  model  input  must  be  collectable  with  a reasonable 
effort . 

5.  The  model  must  reflect  actual  error  distributions  found,  instead  of 
those  most  easily  handled  mathematically. 

Two  models  which  have  been  proposed  for  this  application  were  described 
in  Section  3.  The  first  is  the  RSS  approach,  which  combines  characteristics 
of  individual  error  components  into  an  estimate  of  total  vertical  position 
error.  The  second  model,  originally  formulated  by  Reich,  combines  character- 
istics of  the  error  distributions  in  each  of  the  three  coordinate  directions 
(along  track,  across  track,  and  vertical)  into  a measure  of  collision  risk. 

Neither  of  these  approaches  meets  all  five  of  the  criteria  listed  above. 
The  RSS  method  does  not  meet  criterion  2,  since  it  does  not  relate  directly 
to  a safety  measure,  and  it  also  fails  criterion  5 since  it  relies  heavily  on 
the  normal  distribution  even  though  a fatter-tailed  distribution  may  apply. 

The  Reich  model  does  not  meet  criterion  1,  since  there  is  no  way  to  relate 
system  characteristics,  other  than  the  total  error  distributions  in  each  of 
the  coordinate  directions,  to  the  collision  risk.  Both  approaches  do  involve 
computable  models  whose  data  are  collectable,  meeting  criteria  3 and  4. 

Since  neither  model  is  wholly  satisfactory,  this  report  has  contained 
suggestions  for  modifying  and  combining  the  two  approaches  into  one  which  would 
meet  all  five  criteria.  Such  an  approach  would  rely  either  on  a modified  RSS 
method  or  on  convolution  of  individual  error  distributions  for  obtaining  the 
distribution  of  vertical  position  error,  and  then  use  that  distribution 
as  input  to  the  Reich  collision  risk  calculations.  Other  approaches  listed 
in  Sections  3.5  and  3.6  might  also  be  examined  in  future  work. 

In  Section  2 of  the  report  we  discussed  in  detail  many  of  the  component 
errors  which  contribute  to  vertical  position  error.  The  detailed  component 
errors  were  then  combined  into  4 categories: 

1.  static  pressure  system  errors, 

2.  altimeter  instrument  errors, 
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3.  pilot  response  errors,  and 
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4.  other  errors. 

The  error  distributions  for  these  categories,  if  known,  would  be  input  to  a 
RSS  or  convolution  model  of  the  total  vertical  position  error.  It  is  assumed 
for  this  process  that  these  errors  are  independent  and  additive,  with  known 
standard  deviations  (for  the  RSS  approach)  or  known  distributions  (for  the 
convolution  approach) . 

t 

Section  4 of  the  report  discussed  the  collection  of  data  on  the  component 
and  total  vertical  position  error  distributions.  Existing  data  have  proved 
inadequate  for  determining  these  distributions;  much  previous  modeling  has 
been  based  on  assumptions  that  distribution  types  are  of  a particularly 
tractable  form,  rather  than  whether  they  are  suitable  or  appropriate  for  the 
actual  data.  Auxiliary  factors  whose  neglect  might  create  systematic  bias 
in  a collected  data  set  have  also  been  discussed. 

Because  of  the  size  of  the  data  set  required  to  estimate  the  tails  of 
the  distributions.  Section  4 stresses  the  importance  of  a well-designed  plan 
for  collecting  the  data,  taking  into  account  the  various  factors  which  could 
bias  the  results.  The  collection  of  such  a data  set  will  clearly  provide  a 
more  solid  basis  for  evaluating  alternative  approaches  to  modeling  aircraft 
vertical  separation  above  FL290. 
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COMPARISONS  OF  TAIL  LENGTHS  OF  DISTRIBUTIONS 


This  appendix  provides  a formal  justification  of  the  observation,  made 
in  Section  3.4  on  the  basis  of  Monte  Carlo  simulations,  that  the  convolution 
of  (zero-mean)  normal  and  rectangular  distributions  cannot  yield  a distri- 
bution with  longer-than-normal  tails.  In  fact,  a much  more  general  result 
is  shown  to  obtain:  namely,  the  convolution  of  a normal  distribution  with  a 
continuous  distribution  defined  over  a finite  range  cannot  have  longer-than- 
normal  tails. 

It  is  assumed  that  the  random  variables  X,Y,Z,...  under  consideration 
have  distributions  with  mean  0 and  finite  variance.  For  such  random 
variables,  the  following  definitions  for  judging  relative  tail  lengths  seem 
quite  reasonable. 

DEFINITION.  Suppose  X and  Y have  the  same  mean  and  same  variance.  Then  the 

random  variable  X is  longer  tailed  than  random  variable  Y if  there  exists 

t >0  such  that 
o 

Prob  { | X | > t)  > Prob  { |y|  > t} 


for  all  t > t . 

o 


DEFINITION.  Given  a random  variable  X,  let  Y be  the  normal  random  variable 
having  the  same  variance  as  X.  We  say  X has  shorter  tails  than  normal 
if  Y has  a longer  tail  than  X. 


We  now  show  that  if  X is  normal  and  Y is  a continuous  random 
variable  defined  over  a finite  range  (both  variables  being  independent),  then 
the  variable  Z = X + Y has  shorter  tails  than  normal.  In  other  words,  it  is 
impossible  to  obtain  a distribution  with  longer-than-normal  tails  by  convoluting 
a continuous  distribution  having  a finite  range  with  a normal  distribution.  To 
demonstrate  this,  suppose  that  X and  Y are  independent  random  variables  with 
mean  0.  Let  g(t)  be  the  probability  density  function  for  Y,  where  g(t)  = 0 
outside  [-B,A],  and  the  standard  deviation  of  Y as  a.  Without  loss  of 
generality,  it  may  be  assumed  that  X follows  a normal  distribution  with  unit 
standard  deviation.  By  the  convolution  formula  given  in  Section  3.4,  the 
probability  density  function  of  Z = X + Y is 

A 

(A. 1)  f(x)  =_£k  exp{-(x-t)z/2)  g(t)  dt, 


-1/2 

where  the  abbreviation  k = ( 2tt ) is  used.  Since  Y has  standard  deviation 

1,  it  follows  from  the  RSS  formula  that  Z has  standard  deviation 


(A. 2) 


a 

o 


(1  + a2) 


1/2 


The  tails  of  f(x)  are  to  be  compared  with  those  of  the  normal  distribution 
having  the  same  standard  deviation  aQ,  namely 


► l 


(A. 3)  f (x)  = (k/a  ) exp{-x2/2o2 } . 

o 0 0 

It  will  be  shown  below  that 

(A. 4)  f(x)/fQ(x)  -*-0  as  x , 

and  this  implies  that  fQ(x)  has  longer  tails  than  f(x). 

For  the  proof  of  (A. 4),  first  observe  that 


-(x-t)2/2  = -x2/2  + xt  - t2/2  £ -x2/2  + xt  , 
so  it  follows  from  (A.l)  that 

A 

(A. 5)  f(x)  = k_-g  exp{-(x-t)2/2)  g(t>  dt 

£ k exp{-x2/2}  exp{xt}  g(t)  dt  . 

Since  g(t)  is  continuous  over  the  closed  interval  [-B,A],  it  attains  a finite 
maximum  g on  that  interval:  that  is,  g(t)  £ g for  all  -B£t£A.  Thus,  using 
(A. 5),  ° ° 

4 

f(x)  < kg  exp{-x2/2}  J exp{xt}  dt 

O — D 

= kgQ  exp{-x2/2}  (exp{Ax}  - exp{-Bx})/x  . 

From  this  and  (A. 3),  we  have  for  x > 0 

(A. 6)  f(x)/fQ(x)  < 0ogo  exp{-ax2/2}(exp{Ax})/x  , 

where  a = 1-1/a2  > 0 because  of  (A. 2).  Since  the  right-hand  side  of  (A. 6) 
goes  to  0 as  x ^ °",  the  truth  of  (A. 4)  is  readily  established. 
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In  particular,  the  above  result  shows  that  the  convolution  of  a normal 
and  a rectangular  distribution  yields  a distribution  having  shorter  tails  than 
normal.  Moreover,  the  result  implies  that  the  repeated  convolution  of  a 
normal  with  any  number  of  rectangular  distributions  is  again  shorter-tailed 
than  normal.  Actually,  the  assumption  of  continuity  is  not  crucial  for  the 
result  to  hold;  rather,  it  is  only  necessary  that  the  probability  density 
function  (which  encloses  unit  area)  be  bounded.  For  example,  it  can  be  shown 
that  the  convolution  of  a normal  distribution  with  a limit  (two-point  discrete) 
distribution  — it  does  not  have  (and  is  not  well-approximated  by  distributions 
having)  a bounded  density  — yields  a distribution  that  has  longer  (not 
shorter)  tails  than  normal.  However,  since  the  convolution  of  a rectangular 
and  a limit  distribution  does  have  a bounded  probability  density  function,  the 
convolution  of  a number  of  normal,  rectangular  and  limit  distributions  cannot 
have  longer-than-normal  tails. 
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